The following pages summaries the corrective actions listed in the CERT^®/CC records. Table B.1 presents the data in tabular form. This table shows the following for each category:

1. First report - The reporting date of the earliest incident where the action was recorded.
2. Mean Report - The mean reporting date for all incidents where the action was recorded.
3. Last Report - The reporting date of the last incident where the action was recorded.
4. Incidents - The total number of incidents reporting the action.
5. Delta - The difference between the Mean Reporting Dates for the incidents reporting the action and the Mean Reporting Date for all incidents.

This same data is plotted in Figures B.1 to B.6. The first four of these Figures present the internal corrective actions, and the external corrective actions are presented in the last two Figures.

Of the 4,299 incidents, 1.5% (63) of the incident reports recorded no corrective actions. The remaining 98.5% (4,236) of the incident reports record as a minimum some indication that one of more sites involved were notified. This corrective action (notifying sites) is not listed in Table B.1 or in the Figures after that. The Table and Figures show the other corrective actions that are recorded in 1,388 (32.3%) if the incidents in the CERT^®/CC records.

Large black squares indicate the mean reporting date of the incidents in that category. The first and last reporting dates are indicated by the vertical line. The number of incident records which record the particular corrective action are given by the numbers at the bottom of each column in the chart. The letters and numbers at the bottom of the chart indicate the specific corrective actions or groups as follows:

A - All Incidents 1 - Disable TFTP 6 - Disconnect from Internet

B - All Corrective Actions 2 - Disable FTP 7 - Filter network traffic

C - All Internal Actions 3 - Install TCP wrapper 8 - Restrict logins

D - All Restrict Hardware/Software Actions 4 - Close account(s) 9 - Delete .rhost file(s)

5 - Install firewall

Large black squares indicate the mean reporting date of the incidents in that category. The first and last reporting dates are indicated by the vertical line. The number of incident records which record the particular corrective action are given by the numbers at the bottom of each column in the chart. The letters and numbers at the bottom of the chart indicate the specific corrective actions or groups as follows:

A - All Incidents D - All Restrict Hardware/Software Actions 3 - Secure server/router

B - All Corrective Actions 1 - Restrict server 4 - Change password(s)

C - All Internal Actions 2 - Change permissions 5 - Change configuration

Large black squares indicate the mean reporting date of the incidents in that category. The first and last reporting dates are indicated by the vertical line. The number of incident records which record the particular corrective action are given by the numbers at the bottom of each column in the chart. The letters and numbers at the bottom of the chart indicate the specific corrective actions or groups as follows:

A - All Incidents D - All Restrict Hardware/Software Actions 3 - Upgrade software

B - All Corrective Actions 1 - Add traps 4 - Reload software/router

C - All Internal Actions 2 - Patch software

Large black squares indicate the mean reporting date of the incidents in that category. The first and last reporting dates are indicated by the vertical line. The number of incident records which record the particular corrective action are given by the numbers at the bottom of each column in the chart. The letters and numbers at the bottom of the chart indicate the specific corrective actions or groups as follows:

A - All Incidents 1 - Spy 5 - Crack

B - All Corrective Actions 2 - Checklist 6 - Tripwire

C - All Internal Actions 3 - Increasing monitoring 7 - Publish reports

D - All Restrict Hardware/Software Actions 4 - Cops 8 - Talk to all users

Large black squares indicate the mean reporting date of the incidents in that category. The first and last reporting dates are indicated by the vertical line. The number of incident records which record the particular corrective action are given by the numbers at the bottom of each column in the chart. The letters and numbers at the bottom of the chart indicate the specific corrective actions or groups as follows:

A - All Incidents D - All Actions Against Intruder 2 - Talk to intruder(s)

B - All Corrective Actions 1 - Arrest 3 - Punish

C - All External Actions

Large black squares indicate the mean reporting date of the incidents in that category. The first and last reporting dates are indicated by the vertical line. The number of incident records which record the particular corrective action are given by the numbers at the bottom of each column in the chart. The letters and numbers at the bottom of the chart indicate the specific corrective actions or groups as follows:

A - All Incidents 1 - Trace 4 - Other law enforcement

B - All Corrective Actions 2 - Investigate 5 - Police

C - All External Actions 3 - Secret Service 6 - FBI

D - All Law Enforcement Actions

Back to the Table of Contents
   [B]